Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:15
Static task
static1
Behavioral task
behavioral1
Sample
735c8ee9d580fbb4481ae7497b765e640e82b7352e63cb6f152f98695c7c9f4c.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
735c8ee9d580fbb4481ae7497b765e640e82b7352e63cb6f152f98695c7c9f4c.html
Resource
win10v2004-20220901-en
General
-
Target
735c8ee9d580fbb4481ae7497b765e640e82b7352e63cb6f152f98695c7c9f4c.html
-
Size
7KB
-
MD5
aeee84403464421fdb91f4ab71b5a0f1
-
SHA1
d0234a089d5d63c987fb24fbe7fc3dfef09d694c
-
SHA256
735c8ee9d580fbb4481ae7497b765e640e82b7352e63cb6f152f98695c7c9f4c
-
SHA512
bca525e266ad88cdb7984955422b153d064e1ecd7f61330fa742f6b2df6137f696e267b3a62b8319e74c1d94a159dc944789c815ce0454dbfc14e85ec18c9aa1
-
SSDEEP
192:uJSG+9PzqN/PR1A8nddLXuSwSTLdlLXugfo2Ku+oLR:ISGabMPvLddLXuSwSTLdlLXugfo2KaR
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376045700" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000064fa3d3ca7d5f4db31e24aa5bd29d4f00000000020000000000106600000001000020000000d3c88b8ac4ab19a67b9d3e01a7cbc1b99c63db46ac6d33778c9881e82f94154e000000000e800000000200002000000096cffd5a145310b582f31e865a8e9f6c9d813ec50a71a8a2a9d8ea1354c0b7712000000086a07eb1bbbd16538546ce268b3abe5ee5bb6597a1b673fad955545d9ec784f440000000925ad17e517ca3f9f1141170fd5abdb2d47a47ac9d193e1e08004fb53749d3fb34e0d1f0ef6f29aaafe967bbbdc6356056ef9218e9f59918013b853fa52f1b43 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000064fa3d3ca7d5f4db31e24aa5bd29d4f00000000020000000000106600000001000020000000fa040722fbe1419996a46a91ebf2c9429bd45c739dd7053051d99f0c0fa9cd80000000000e80000000020000200000003ec069e1e1443d891b92fd4387956ab8ef08e546383c994f1692ffdb0671e79d90000000c0d2ca5cf6bbd45a8d626ed21f2713b29969018ce021bd8c3c668ccbd6ddafd1a9c840af6c4277e2cb765226ef8ddb7aa0e4a1ae02831dacd4af758e6f59f1abeb63e9bc1a72faa822a60e0d083204895a47c039d861fb112409db8122a95007ea76e7edc6ab7727834e0814e1a24feb32542a55757838428e0ce31a8cd1246b1f58464da8717e4b4c8179a1e80f5eff400000007da8aea78d6fc9fcef7c7d7cd282f5859a0ccfdae0dc2c25d2535e91bcea6195cfaef83e01777fed83a61b5d4eb2f4a50f597291dbb8666c521ae9f470360975 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11A96C11-6BD7-11ED-9AD4-7A3897842414} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102881e7e3ffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1788 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1788 iexplore.exe 1788 iexplore.exe 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1788 wrote to memory of 2040 1788 iexplore.exe IEXPLORE.EXE PID 1788 wrote to memory of 2040 1788 iexplore.exe IEXPLORE.EXE PID 1788 wrote to memory of 2040 1788 iexplore.exe IEXPLORE.EXE PID 1788 wrote to memory of 2040 1788 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\735c8ee9d580fbb4481ae7497b765e640e82b7352e63cb6f152f98695c7c9f4c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2YNNTASR.txtFilesize
603B
MD52a6e7df2f4bd72fd179a5e899fa617e1
SHA16686dbdf07d34aa04c6a459390b742bd4ee7bb3b
SHA256bbebe13116eab7677292492119855f84e1d462199f0c54e2b7f15e38f68e6582
SHA51275fc220af187d9dbc90b934e01ba399e234a3925c4bafc990765ea8340037c634cefeb0511a318ad5633b3e6553660781e680842a7fb8a0c0140992fc4ae59ee